Labor & Employment Law Daily Wrap Up, PRIVACY—D. Md.: DOGE temporarily restrained from accessing personally identifiable information in Social Security records, (Mar 24, 2025)

By Jason Albright, J.D.

“Ironically, the identity of these DOGE affiliates has been concealed… The defense does not appear to share a privacy concern for the millions of Americans whose SSA records were made available….”

A federal district court in Maryland last week temporarily restrained the Social Security Administration (SSA) from granting DOGE or its affiliates access to any SSA system of record containing personally identifiable information (PII), including millions of Americans’ Social Security numbers, medical records, drivers’ license numbers, bank and credit card information, tax information, income history, work history, birth and marriage certificates, and home and work addresses. “The DOGE Team,” said the court, “is essentially engaged in a fishing expedition at SSA, in search of a fraud epidemic, based on little more than suspicion,” and AFSCME is likely to succeed on its claim that such action is arbitrary and capricious in violation of the Privacy Act and the APA. The union also showed that its members will suffer irreparable harm in the absence of a TRO, that the equities tip in the plaintiffs’ favor, and that a TRO serves the public interest, concluded the court (AFSCME v. Social Security Administration, No. ELH-25-0596 (D. Md. Mar. 20, 2025)).

10 anonymous individuals with “unfettered access.” This case concerns the decision of the SSA to provide 10 anonymous individuals affiliated with DOGE with “unfettered access to the SSA records of millions of Americans.” In particular, the information at issue in SSA’s records includes Social Security numbers, personal medical and mental health records, driver’s license information, bank account data, tax information, earnings history, birth and marriage records, home and work addresses, school records, immigration and/or naturalization records, health care providers’ contact information, family court records, and employment and employer records.

“Ransacked.” According to the plaintiffs, the defendants have “ransacked” the SSA, “installing DOGE associates without proper vetting or training... and demanding access to some of the agency’s most sensitive data systems.” The suit “seeks to protect Plaintiffs and their members against the ongoing (and ever increasing) harm caused by DOGE and certain SSA executives’ unlawful seizure of personal, private, and sensitive data from SSA systems.”

Lawsuit. Among other things, the plaintiffs alleged that the SSA defendants have unlawfully disclosed and continue to disclose “personal records contained in systems of records under their control,” without consent of plaintiffs’ members, in violation of the Privacy Act, 5 U.S.C. § 552a, and Section 706(2) of the APA. The plaintiffs also alleged that, “[i]n directing and controlling the use and administration of Defendant SSA’s systems,” the named DOGE defendants—including Elon Musk—have engaged in security breaches and unlawful disclosures constituting “ultra vires actions that injure Plaintiffs by exposing their sensitive, private, and personally identifiable information and increasing the risk of further disclosure of their information.”

TRO sought. The plaintiffs moved for a TRO to: (1) enjoin the DOGE defendants from accessing, using, or disclosing tax “return information, personally identifiable information, or non-anonymized information” housed by the SSA; (2) direct the DOGE defendants to “disgorge or delete all unlawfully obtained, disclosed, or accessed data”; (3) prohibit the DOGE defendants from “installing any software on SSA devices” or “accessing, or disclosing any SSA computer or software code”; and (4) enjoin all defendants’ “access, inspection, disclosure, or use of any SSA information system,” or “data obtained therefrom,” for any purpose other than those permitted by the Privacy Act and other applicable laws.

Privacy Act. Granting the TRO, the court first found that the plaintiffs had shown a likelihood of success on the merits as to their claim that the access to records provided by SSA to the DOGE team does not fall within the need-to-know exception to the Privacy Act, 5 U.S.C. § 552a(b)(1), which permits agency employees access to protected records only when there is “a need for the record in the performance of their duties.”

“Besides cursory, circular statements about members of the DOGE Team in need of all SSA data because of their work to identify fraudulent or improper payments,” observed the court, “counsel provided no explanation as to why or how the particular records correlated to the performance of job duties.” They failed to provide a “particularized explanation of how or why virtually the entire data base of SSA is needed to conduct the investigation, or why redacted or anonymized records, at least initially, would be inadequate.”

Arbitrary and capricious. The plaintiffs also showed a likelihood of success that the SSA’s action was arbitrary and capricious in violation of the APA. As discussed, the defendants failed to provide a reasonable explanation for why the DOGE team needs access to “the wide swath of data maintained in SSA systems in order to root out fraud and abuse.”

As detailed by one of the individual defendants, a retired SSA official, SSA has practices in place for audits or other searches for alleged fraud or abuse. The defendants, however, “disregarded protocols for proper hiring, onboarding, training, and access limitations, and, in a rushed fashion, provided access to a massive amount of sensitive, confidential data to members of the DOGE Team, without any articulated explanation for the need to do so.”

Goose and gander. The defendants “clearly understand why guarding privacy, rather than waiting for harm to occur, is important,” observed the court. “After all, that is precisely the reason why they have withheld even the names of the members of the SSA DOGE Team. But, defendants have not shown the same level of care with the far more sensitive, confidential data of millions of Americans who entrusted their government with their personal and private information.”

Irreparable harm. The court further found that the plaintiffs demonstrated irreparable harm. Several individuals affiliated with DOGE have been granted access to sensitive data, including medical information, and because the defendants believe this access is necessary for these employees, there “is no reason to think it will end anytime soon.” And though the plaintiffs do not know if their information has been viewed or documented by any of the DOGE employees, “nor how many times it has been viewed or will continue to be viewed in the coming hours, days, weeks, or months,” they do know their sensitive, personally identifiable information is “accessible to the DOGE Team on a daily basis, with no proper justification,” observed the court, and money damages cannot rectify this invasion of the privacy of the plaintiffs’ members.

“[S]ociety expects as much.” Finally, the court found that a balance of the equities and the public interest favored issuance of a TRO. “[T]here is a strong public interest in maintaining the confidentiality of PII, such as medical records and financial information,” said the court. “Indeed, society expects as much.”

The defendants admitted that the SSA granted DOGE personnel “broad access to millions of Americans’ sensitive PII,” and this “intrusion into the personal affairs of millions of Americans—absent an adequate explanation for the need to do so—is not in the public interest.” Though “rooting out possible fraud, waste, and mismanagement in the SSA” is in the public interest, “that does not mean that the government can flout the law to do so.” In short, concluded the court, “[t]he President’s advisors and employees are not exempt from the statutes Congress enacted to protect American citizens from overbroad and unnecessary access to their PII.”

The temporary restraining order was granted.

The case is No. ELH-25-0596.

Judge: Hollander, E.

Attorneys: Alethea Anne Swift (Democracy Forward) for American Federation of State, County and Municipal Employees, AFL-CIO. Elizabeth J. Shapiro, U.S. Department of Justice, for Social Security Administration.

Companies: American Federation of State, County and Municipal Employees, AFL-CIO

Cases: Privacy DOGE FedTracker UnionsMembers PublicEmployees AgencyNews WhiteHouseNews MarylandNews